Packet processing using encapsulation and decapsulation chains

ABSTRACT

In an embodiment, a network router includes plural interfaces and a chain walker which, upon receipt of a first protocol packet in a first interface, processes the packet by walking the packet through a decapsulation chain associated with the interface and the first protocol and an encapsulation chain associated with an identified second interface and identified second protocol. The walker passes the packet to elements of the decapsulation chain to produce a decapsulated packet. The walker passes the decapsulated packet to elements of an encapsulation chain to produce an encapsulated packet. Each chain includes at least one packet-processing element. An element receives the packet from the walker as processed by a previous element, the packet being further processed as appropriate. The walker, upon receipt of the first protocol packet, passes the packet to elements of a demultiplexer chain associated with the first interface to produce a demultiplexed packet.

RELATED APPLICATION(S)

This application is a divisional of U.S. application Ser. No.10/408,187, filed Apr. 4, 2003, now U.S. Pat. No. 6,907,468 which is acontinuation of U.S. application Ser. No. 09/419,035, filed Oct. 15,1999 (U.S. Pat. No. 6,578,084). The entire teachings of the aboveapplications are incorporated herein by reference.

In addition, this application discloses subject matter that is relatedto subject matter disclosed in the following applications, assigned toCisco Systems, Inc., the assignee of the present invention, and areincorporated herein by reference:

U.S. Ser. No. 09/418,781, Kenneth Moberg and Manoi Leelanivas, PACKETPROCESSING USING NON-SEQUENTIAL ENCAPSULATION AND DECAPSULATION CHAINS,filed on Oct. 15, 1999.

U.S. Ser. No. 09/418,723, Kenneth Moberg, Kristen Marie Robins, andWilliam May, DISTRIBUTED PACKET PROCESSING USING ENCAPSULATION ANDDECAPSULATION, filed on Oct. 15, 1999.

BACKGROUND OF THE INVENTION

A network is a communication system that allows a user on a computer toaccess resources and exchange messages with users on other computers. Anetwork is typically a data communication system that links two or morecomputers and peripheral devices. It allows users to share resources ontheir own systems with other network users and to access information oncentrally located systems or on systems that are located at remoteoffices. It may provide connections to the Internet or to the networksof other organizations.

A network typically includes a cable that attaches to a networkinterface card (NIC) in each of the devices within the network.

Users interact with network-enabled software applications to make anetwork request, such as to get a file or print on a network printer. Anapplication may also communicate with the network software, and thenetwork software may then interact with the network hardware to transmitinformation to other devices attached to the network.

A local area network (LAN) is a network located in a relatively smallarea, such as a department or building. A LAN typically includes ashared medium to which workstations attach and through which theycommunicate with one another by using broadcast methods. Withbroadcasting, any device on a LAN can transmit a message that all otherdevices on the LAN can listen to. The device to which the message isaddressed actually processes the message. Data is typically packagedinto frames for transmission on the LAN.

FIG. 1 is a block diagram illustrating a network connection between auser 2 and a particular web server 6. This figure is an example, whichmay be consistent with any type of network, including a LAN, a wide areanetwork (WAN), or a combination of networks, such as the Internet.

When a user 2 connects to a particular destination, such as a requestedweb server 6, the connection from the user 2 to the web server 6 istypically routed through several routers 4A-4D. Routers areinternetworking devices, typically used to connect similar andheterogeneous network segments into Internetworks. For example, two LANsmay be connected across a dial-up, integrated services digital network(ISDN), or a leased line via routers.

Routers are also found throughout the Internet. End users may connect tolocal Internet Service providers (ISPs), which are typically connectedvia routers to regional ISPs, which are in turn typically connected viarouters to national ISPs.

To move packets from one network to another, packet processing softwareis required on each router. Generally, packets received from a networkare processed and forwarded to another network, based on informationcontained in layers 2 and 3 of the ISO 7-layer model.

Layer 2 (L2) of the ISO model is commonly referred to as the data-linklayer. Ethernet, HDLC and PPP are examples of commonly used L2protocols. Ethernet is commonly used in LANs, while HDLC and PPP arecommonly used in WANs. Layer 3 (L3) is commonly referred to as thenetwork layer. Internet Protocol (IP) is the most commonly used L3protocol. ARP, SAP and SNAP are IP-related protocols that, although notstrictly in layer 2, are considered to be layer 2 protocols for purposesherein.

Layer 4 (L4) is commonly referred to as the transport layer. TCP is themost commonly used L4 protocol.

Router software designers use the term encapsulation to refer to thelayering of protocols. A packet containing TCP, IP and ethernetprotocols is said to have an encapsulation of TCP over IP over ethernet.A packet containing TCP, IP and HDLC protocols has an encapsulation ofTCP over IP over HDLC.

The proliferation of features and protocols has greatly complicated thesoftware involved in processing packets. Because of this, the softwareresponsible for each layer must examine each packet to determine whatthe next step is in the handling of the packet.

For example, when a packet is received on an ethernet interface, theethernet protocol handling software must examine the header, and basedon values in the header, determine what to do with the packet. Datacontained within a packet, for example, a type or length field in theprotocol header, contains information about the next layer of thepacket.

A traditional ethernet processing algorithm for this might be:

If type=IP and IP is configured for this interface

-   -   Pass packet to IP code

If type=ARP and ARP is configured for this interface

-   -   Pass packet to ARP code

If type=RARP and RARP is configured for this interface

-   -   Pass packet to RARP code

If type=IPV6 and IPV6 is configured for this interface

-   -   Pass packet to IPV6 code

Each time a new protocol is added, the ethernet code must be modified tohandle the new protocol. This may be necessary for each layer every timenew features or protocols are added. Router software has grown to thepoint where maintenance has become very difficult. Each change can causewide variations in performance. A new method is thus needed to allowgrowth in features and protocols without affecting the stability ofexisting software.

SUMMARY OF THE INVENTION

The present invention solves the above problems by logically separatingthe various packet operations into chain elements. These elements arethen dynamically chained together as needed, at runtime, to formencapsulation and decapsulation chains.

The chains can also be dynamically rebuilt upon a change ofconfiguration. Such changes typically come from a customer command lineinterface, however, in some cases there may be features that areconfigured after a protocol negotiation.

With the employment of chains, developers of new features do not need tochange existing code to introduce the new features. Instead, new chainelements can be developed and inserted into existing chains asnecessary.

As a result of the improved modularity, performance is improved forcomplex operations.

Accordingly, a method for processing packets in a router includesspecifying packet processing function elements and linking them togetherto form chains. Each chain is associated with a uniqueinterface/protocol pair. As used herein, a protocol may be arouter-level protocol such as IP, or it may be a bridge-level protocol.Furthermore, the term protocol is meant to encompass the concept oftunneling, where a packet which has already been encapsulated using oneprotocol is further encapsulated using the same or a different protocolat the same level. In such a case, one or more virtual interfaces may beencountered by a packet which encapsulate and decapsulate the packetaccording to various protocols. An interface, then, is simply the targetof a packet, and may be implemented in hardware, software, or both.

Each processing element within a chain performs at least one function ona packet. An incoming packet is received, and processed, first by ademultiplexor (demux) element which determines the protocol of the nexthigher level used by the packet. Then, the packet is processed by theelements of a decapsulation (decaps) chain associated with the interfaceon which the packet was received, and by the elements of anencapsulation (encaps) chain associated with the interface on which thepacket is to be transmitted.

In one embodiment, the demultiplexor element or operation passes thepacket on to a decapsulation chain associated with the protocol and withthe incoming interface, depending on protocol information contained inthe incoming packet. The protocol information may be contained, forexample, in a type or length field in a header.

Decapsulation and encapsulation chains can be built dynamically, byinserting new and removing old elements as necessary as new protocolsare developed and new features added.

In addition to decapsulation, the decapsulation chain can includefunctions including, but not limited to, decryption, decompression andfiltering. Similarly, an encapsulation chain can include, in addition toan encapsulation operation, encryption, compression, flow control andfiltering functions, as well as other function.

A chain walker walks through the chains, passing the processed packet toeach element in a chain, until either the end of the chain is reachedand processing is complete, or until the packet is dropped because nofunction can process it, or because a packet is processed by an outsideprocess or by hardware, which may optionally stop the chain walk.

A chain walk may be temporarily halted, or may be terminated. Iftemporarily halted, the chain walk can be resumed at any element in thechain, depending on the packet's requirements. A chain walk can alsobegin at any element in a chain.

A packet may be intended for the router, in which case processing endsafter the decapsulation chain terminates. In addition, the router itselfcan generate packets. The destination or outgoing interface isdetermined, and the packet is processed by executing processing elementswithin a selected encapsulated chain associated with the outgoinginterface. Finally, the packet is transmitted from the outgoinginterface.

Preferably, an embodiment uses a chain walker which, upon receipt of anincoming packet in an incoming interface, executes the demux chainassociated with the incoming interface, a decapsulation chain associatedwith the incoming interface, and an encapsulation chain associated withan identified outgoing interface. After an element is executed fromchain walker, the element returns a reference to the next element in thechain. The chain walker then executes the referenced next element. Onthe other hand, if the element returns a null reference, the chainwalker stops.

In addition, a return code can notify the chain walker that the packetshould be dropped.

One embodiment implements the chains and chain walker using an interfacedescriptor block (IDB) associated with each interface. An IDB includes areference or pointer to a demux element associated with the associatedinterface, a reference to a decapsulation chain array, and a referenceto an encapsulation chain array. Each encapsulation or decapsulationarray holds references or pointers to chains of encapsulation ordecapsulation processing elements, respectively.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing and other objects, features and advantages of theinvention will be apparent from the following more particulardescription of preferred embodiments of the invention, as illustrated inthe accompanying drawings in which like reference characters refer tothe same parts throughout the different views. The drawings are notnecessarily to scale, emphasis instead being placed upon illustratingthe principles of the invention.

FIG. 1 is a block diagram of an example of a network connection betweena user and a web page.

FIG. 2 is a block diagram illustrating a simple network connecting auser on an ethernet LAN to a remote server on a different ethernet LAN,with a serial WAN using HDLC connecting the two LANs.

FIG. 3 is a schematic diagram illustrating decapsulation andencapsulation of a message as performed by a router.

FIG. 4 is a schematic diagram illustrating an embodiment of the presentinvention including a chain walker.

FIG. 4A is a schematic diagram illustrating an embodiment of the presentinvention having a virtual interface.

FIG. 4B is a schematic diagram of an embodiment of the present inventionwith different chains than those of the previous figures.

FIG. 4C is a schematic diagram of an alternative embodiment of thepresent invention illustrating a non-sequential chain.

FIG. 4D is a schematic diagram of an alternative embodiment of thepresent invention illustrating another non-sequential chain.

FIG. 5 is a schematic diagram of the data structures used to implementdecapsulation and encapsulation chains of the present invention.

FIG. 6 is a flowchart illustrating an embodiment of the chain walker.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 2 illustrates a simple network 10 to which several systems 14 areconnected.

In particular, the network connects a user 14A on one ethernet LAN 12Awith a remote server 14B on a different ethernet LAN 12B, with a serialWAN 16 using HDLC to connect the two LANs 12A, 12B. Two routers 15A and15B provide the interfaces between the two types of networks.

The ethernet LANs 12A, 12B use ethernet protocol, while the serial WAN16 uses HDLC protocol. For a TCP packet to reach the server 14B, therouters 15A, 15B must change the encapsulation from ethernet to HDLC,and then back to ethernet. These encapsulations are associated with andconfigured for each interface.

Local area network 12A uses, for example, the protocol shown in block18A. Here, HTTP protocol is used by the application. TCP and IPprotocols as well as ethernet protocol are used throughout the localarea network. The same protocols are used in local area network 12B asshown in block 18B.

The wide area network 16, however, uses HDLC protocol instead ofethernet, as shown in block 18C, because this protocol is better suitedto wide area networks. Therefore, it is necessary for the routers 15A,15B to translate packets from the ethernet Protocol to HDLC protocol andback to ethernet protocol.

FIG. 3 illustrates basic decapsulation and encapsulation as performed byrouter 15A of FIG. 2. An incoming packet 20A contains a message or otherdata 22 which is encapsulated with an HTTP header 24 which in turn isencapsulated with a TCP header 26. This in turn is encapsulated with anIP header 28 and the packet is finally encapsulated in an ethernetframe, including an ethernet header 30.

The router 15A reformats and readdresses the packet by stripping off theethernet header 30, or decapsulating the frame, and reading the IPheader 28 to obtain a destination address. The packet now appears asshown at 20B.

Next the router prepends the packet with an HDLC header 32 as shown at20C. The router has thus encapsulated the message in a HDLC packetformat.

In practice, the decapsulation and encapsulation processes can be morecomplex, including compression, encryption and other functions. Thepresent invention breaks these functions into individual elements, anddynamically chains the elements together at runtime, as needed, using alinked chain structure in one embodiment. For example, a chain can bedynamically built at the start of a session. Each session can then haveits own chain.

A chain walker processes a packet by walking through a chain, passingthe packet to each element in the chain, until either processing iscompleted, the chain is halted, or the process is dropped. Each elementalso has the ability to “punt” the packet to an external software orhardware function, and the punted packet may be returned anywhere in thechain, or may not be returned at all.

FIG. 4 illustrates an embodiment of the present invention. The routershown 15 represents either router 15A or 15B of FIG. 2. While a typicalrouter may have multiple interfaces, only two 51, 53 are shown in FIG.4.

When a packet is received by the router 15, it is passed to the chainwalker 55. The chain walker 55 in turn retrieves a pointer to ade-multiplexor, or demux, element. Because in this example, interface 51is an ethernet interface, the demux element 57 performs an ethernetdecapsulation operation. For other types of interfaces, otherdecapsulation functions would be used in the demux chain.

The demux operation or element 57 determines the protocol of the nexthigher level (L3) used by the incoming packet, and passes the packet toan appropriate decapsulation chain. Although it will be understood thatthere can be many more, four possible decapsulation chains are shown: anARP decapsulation chain comprising a single element arp_decaps 59; a SAPdecapsulation chain comprising a single element sap_decaps 61; a SNAPdecapsulation chain comprising a single element snap_decaps 63; and amulti-element IP decapsulation chain 64.

Of course, other decapsulation chains can exist for processing otherprotocols as well. For illustrative purposes, assume the packet usesinterne protocol (IP). In this case, the demux element Ether_decaps 57returns a pointer to the first element 65 of the IP decapsulation chain64 to the chain walker 55, as indicated by dotted line 86. Logically,decrypt 65 follows ether_decaps 57 as indicated by solid arrow 85.

Decrypt 65 is the first element in the IP decapsulation chain 64. Inthis example, the decapsulation chain 64 is shown to comprise adecryption element 65, a decompression element 67, and an ip_switchelement 69. In an actual application, some or all of these elements maybe absent, or additional elements may be in the chain.

In actuality, for IP packets that are switched, there is nodecapsulation, although the term “decapsulation chain” is retained. Theip_switch element 69 determines if the packet is to be switched orpunted for further processing. For A TCP packet that is destined for therouter itself, the actual decapsulation is performed in the IP processafter the packet has been punted. Similarly, the arp_decaps element 59simply punts the packet to the ARP process.

As indicated by the dashed lines 79, the process of chain walking can beimplemented by having each chain element return to the chain walker 55 apointer to the next chain element. The chain walker then calls the nextelement in the chain.

After decapsulation, the router must prepare the packet for furthertransmission by encapsulating it in the desired protocol, assuming thepacket is not intended for the router itself. Dashed line 88 separatesthe decapsulation chain 64 from the encapsulation chain 74. The packetis passed from the ip_switch element 69 to an encapsulation chain 74associated with the intended output HDLC interface 53, beginning withthe ip_rewrite element 70. Ip-rewrite 70 performs functions such asupdating (decrementing) the time-to-live count in an IP packet's header,and recalculating the check sum for the IP header.

The packet is then passed to the compression element 71, the encryptionelement 73 and finally to an HDLC encapsulation element 77. Theencapsulation element 77 then passes the packet to the queue 81 for theintended output interface 53. A scheduler 83 removes the packet from thequeue 81 and transmits via the HDLC interface 53. Packets do not need tobe switched in the de-encapsulation chain walk. Rather, they can behanded to an outside process for further processing and then passed backto the start of the encapsulation chain. This is done for ‘ping’ packetsthat are destined for the router, for example. A chain walk can bestopped, started or resumed from any point on the chain. This allowselements such as an encryption element to pass the packet to an outsideprocess, or piece of hardware, to perform the actual encryption.

The processed packet may then be passed back to continue the chain walk.This mechanism is called ‘punt’ and ‘puntback’. The punting elementhands the packet to the outside process or hardware. If the puntingelement wants the packet to resume the chain walk at the next element inthe chain, it stores the chain next node pointer in the packet. Thepuntback routine starts the chain walk with the node previously storedin the packet.

For example, as indicated by lines 87, an element such as encryptionelement 73 can pass the packet to an encryption process 75 which isexternal to the chain. This is known as “punting” the process packet.The packet may be returned to the punting element, encryption element 73in this example, after processing.

Alternatively, the chain walk could resume processing with any elementin the chain.

ARP, SAP and SNAP are various protocols which fall under the IP protocolfamily. As shown with respect to the ARP, SAP and SNAP decapsulationelements 59, 61 and 63 respectively, packets may be processed byadditional processes 60,62, 66 external to the chains. Packets processedby these functions 60, 62, 66 may then be queued directly at queue 81without passing through an encapsulation chain.

Of course, while only IP, ARP, SAP and SNAP decapsulation chains areshown, additional protocols can also be supported for this interface 51.Each protocol would have its own decapsulation chain.

Note that although the incoming and outgoing interfaces are typicallydifferent interfaces, this is not always true. For example, Ping and ARPare protocols where the incoming and outgoing interface is typically thesame interface.

FIG. 4A illustrates an embodiment of the present invention having avirtual interface 90, which has been inserted at the interface 88 (FIG.4) between the incoming and outgoing chains.

Lines 88A and 88B represent the beginning and ending edges of thevirtual interface 90, respectively. Message packets pass from theip_switch element 69 to the ip_tunnel encaps element 91 within thevirtual interface 90. The ip_tunnel encaps element 91 encapsulates theIP packet into another IP packet, i.e., it implements IP over IP, andpasses the tunneled packet to an ip_switch element 69A, which may or maynot be the same as ip_switch 69 in the incoming chain. The encapsulatedJP packet is then passed out of the virtual interface 90 across line 88Bto the encapsulation chain, specifically to the ip_rewrite element 70.

FIG. 4B illustrates chains which are more practical than those of FIG.4, which shows many elements for illustrative purposes.

FIG. 4B shows two interfaces: Serial 1 51B and Serial 2 53B. The decapschain encompasses a decryption element 65B, a decompress element 67B, apoint to point protocol (PPP) decapsulation element 92, and an ip_switchelement 69B. The encapsulation chain comprises an ip_rewrite element70B, HDLC encapsulation element 77B, and queue element 81B, followed bya schedule element 83B which passes the packet to the output serial portSerial 2 53B.

FIG. 4C is a schematic diagram of an alternative embodiment of thepresent invention illustrating a non-sequential chain. In this example,the incoming interface is Ethernet 1 51C and the outgoing interface isSerial 1 53C. The decapsulation chain comprises an ethernetdecapsulation module 57C followed by ip_switch 69C.

Ip_switch 69C passes the packet to the encapsulation chain through theinterface 88, to ip_rewrite 70C which, among other tasks, updates thetime-to-live counter and updates the header checksum accordingly. Theupdated packet is then passed from ip_rewrite to a PPP encapsulationelement 94.

The classifier element 95 then examines the packet, for example, forpacket type or some other characteristic. For example, packets may bevoice or data, as shown in FIG. 4C. In the case of voice, the packet ispassed along path 96A. Voice data is compressed in this example bycompression element 71C-1.

In the case of data, the packet is passed along path 96B. In thisexample, the packet's data is compressed by compression element 71C-2,which may use a different compression scheme than the voice compressionelement 71C-1. The packet is then encrypted by encryption element 73C.Packets from either path are then passed to queue element 81C, andfinally to the scheduler element 83C which then outputs the packetthrough serial interface 53C.

Of course, packets characteristics are not limited to just data andvoice. These are simply offered as examples. Packet characteristics onwhich the classifier 95 may base a decision, include but are not limitedto, for example, protocol type, e.g., IP, TCP, UDP, HTML, ARP, FTP,etc., characteristics such as broadcast, multicast, unicast, etc., TCPor UDP port number, source and/or destination address, media type suchas voice, data, or video.

As with all other elements in the chain, the classifier 95 passes, tothe chain walker 55, a pointer to the next element. However, in oneembodiment, the classifier 95 uses internal knowledge plus its analysisof the packet type to decide along which chain path 96A, 96B to send thepacket. Thus, the chain is not sequential, in that there are multiplebranches a chain may take.

FIG. 4D is a schematic diagram of another chain which can be implementedby a non-sequential embodiment. FIG. 4D shows just an encapsulationchain. A packet is received, from the incoming interface, oralternatively, from a virtual interface, by the ip_rewrite element 70B.In the event ip_rewrite 70B already knows how to encapsulate the packet,it performs the encapsulation, and there is no need to execute the HDLCencapsulation element 77B. The encapsulation element 77B is thus skippedby having the packet take the path 97. In this case ip_rewrite 70Bpasses back a pointer to the next element to be executed through path97A, the next element being the queue element 81B.

If ip_rewrite 70B does not know how to encapsulate the packet, it willprocess the packet normally and return a pointer to HDLC encapsulationelement 77B to the chain walker 55.

Finally, the packet is passed from queue element 81B to the scheduler83B and transmitted out through the Serial 2 port 53B.

The advantage of this embodiment is that it cuts out the extraprocessing required to do an extra chain walk. Often, ip_rewrite 70Bwill know how to encapsulate a packet based on destination. Thisinformation may be returned, for example, by the HDLC encapsulationelement 77B after the first encapsulation of the packet. Ip_rewrite 70Bcan then store this information and use it for later packets with thesame destination or within the session.

There are other reasons for having non-sequential chains. For example,different types of encryption could be applied to packets depending ondestination, type or some other attribute. Furthermore, ip_rewrite canobserve the congestion on the network and for example, skip right to thescheduler if there is no congestion. In very fast Ethernet, for example,a router needs to get packets in and out fast. By allowing the chainelements to be skipped or executed in a non-sequential way, packets arerouted through the router expediently.

Another example where non-sequential chains is useful is, for example,in implementing an access list or other filter. Different chain elementscan be executed depending on the destination and/or depending on accessrights.

The element which causes the non-sequential skip, such as the classifier95 of FIG. 4C, can have internal data which allows it to determine, whena chain is built, what the jump targets are. Determination may be basedon data stored by or for the classifier 94, and based on the incomingpacket itself.

More generally, different feature sets may be applied to packetsdepending on their source address, destination IP address, types orother attributes. The classifier element 95 can, for example, maintainthis information in an internal data base and return, to the chainwalker 55, a pointer to the applicable element.

FIG. 5 illustrates the data structures used to implement sequentialdecapsulation and encapsulation chains, as well as the sequentialportions of non-sequential chains. First, a separate interfacedescriptor block (IDB) 100 is defined for each interface. Each IDB 100includes several fields including a demux field 100A, a decaps arraypointer 100B, an encaps array 100C, queuing information 100D andscheduling information 100E.

The demux pointer 100A points to a demux element 102. The demux element102 is typically the only element in the demux chain. It is responsiblefor removing the outer encapsulation, e.g., ethernet or HDLC, of anincoming packet, and for examining the packet to determine whichprotocol the packet uses.

The decaps array pointer 100B of the IDB 100 points to a decaps array104. The decaps array 104 holds pointers 104A-104D to the first elementsof various decapsulation chains associated with the various protocols.For example, the first entry 104A in the decaps array 104 is a pointerto the first element 106 of an IP decapsulation chain 103.

In one embodiment, each chain element has the structure shown at 106. Anext field 106A points to the next element in the chain. A previousfield 106B points to the previous element in the chain, and is 0 or someother null indicator for the first element. Furthermore, each chainelement 106 contains a data processing element pointer 106C and acontrol processing element pointer 106D which point to the actualprocessing elements. Control data 106E may also be contained in thechain element 106.

A second chain element 107 is shown. The chain may contain a pluralityof elements. Each element returns a pointer to the next element to beexecuted to the chain walker.

Similarly, the encaps array pointer 100C in the IDB 100 points to anencaps array 108. Each entry in the encaps array 108 points to anencapsulation element for a specific protocol. For example, the firstentry 108A is a pointer to an ethernet encapsulation element. The nextentries 108B-108D contain pointers to encapsulation chain elements forother protocols, such as HDLC.

FIG. 6 is a flow chart 120 illustrating an embodiment of the presentinvention.

First, at step 122, a packet is received on an interface. Then, at step124, an IDB is retrieved which is associated with that interface. Atstep 126, a pointer to the demux chain is retrieved from the IDB, andpassed to the chain walker.

The chain walker 55 receives the packet and the pointer from the IDB andsets a return code to 0 at step 130. At step 132 the chain walkerexecutes the current chain element pointed to by the pointer receivedfrom the IDB. A typical chain element is shown at 134. Each element 134on the chain processes the packet, and can return the next element tothe chain walker or set the return code to 0 to stop the chain walk. Thereturn code is set to a value less than 0 if, for some reason, theelement 134 cannot process the packet, in which case the packet is to bedropped. Otherwise, the chain element 134 returns to the chain walker apointer to the next chain element.

As described earlier in the description of FIG. 4, a chain element 134may punt or pass the packet to an external routine or to hardware 138for further processing. The external routine or hardware 138 processesthe packet, and may return control to the chain element, as shown.Alternatively the external routine or hardware 138 may pass the packetto another chain or may halt the process.

A code value is also used to notify the chain walker as to whether itshould continue. If the packet was passed to a higher layer for furtherprocessing, the code is set to a value that tells the chain walker to donothing more. If the packet is to be dropped, the code is set to a valuethat tells the chain walker to drop the packet.

When the packet is returned to the chain walker, in step 140 the chainwalker determines whether the return code is 0. If not, either thepacket is dropped at step 142 or the chain walker stops. If the returncode is 0, then at step 144, the chain walker determines whether a chainelement has been returned. If so the chain walker sets the currentelement to the next element at step 146 and returns to step 132 toexecute the next chain element. This loop is repeated until either thepacket is dropped or until there are no more chain elements.

During initialization, the router's hardware control software determineswhich network interfaces exist on the router. An IDB 100 (FIG. 5) iscreated for each interface. The demux, decapsulation element and theencapsulation element fields are initially empty.

A default demux element is associated with each interface based on theinterface media type, e.g., ethernet, HDLC, etc. Configurationinformation is determined for each interface, for example, by reading itfrom a file or from a programmable memory. Default queuing andscheduling elements are then added to the chain. Finally, decapsulationand encapsulation elements are added to each interface according to theprotocols available as determined by the configurations.

Once the chain for an interface is built, the interface is ready forpacket processing. When a packet is received by an interface it ishanded to the chain walker, as described with respect to FIG. 4. Thechain walker has no knowledge of protocols. For an encapsulation of IPover ethernet, the chain might include only an IP decapsulation element,followed by an encapsulation chain comprising ethernet encapsulation,queuing and scheduling elements.

Chains can have elements added or deleted based on configuration. Eachelement in a chain has no specific knowledge of the other elements onthe chain. The chain walker has no knowledge of the number of elementsor types of protocols on a chain. Each element or node on the chaindetermines the whether or not the chain walk continues based on itsprocessing of the packet.

The above chain could thus be modified by inserting elements into thechains without changing the ethernet, IP, queuing or schedulingelements. For example, an ethernet address filter could be insertedbefore the IP decapsulation element, or a new compression element couldbe inserted at the beginning of the encapsulation chain.

For packets entering the router from an interface, the chain walkertypically starts with the demux element. While there can be any numberof encapsulation and de-encapsulation elements chained together on aninterface, there is typically only one demux element for each interface.For packets that are sourced on the router, the chain walk starts withthe first encapsulation element.

While this invention has been particularly shown and described withreferences to preferred embodiments thereof, it will be understood bythose skilled in the art that various changes in form and details may bemade therein without departing from the spirit and scope of theinvention as defined by the appended claims.

1. A network router, comprising: a plurality of interfaces; and a chainwalker which, upon receipt of a first protocol packet in a firstinterface, processes the packet by walking the packet through adecapsulation chain associated with the first interface and the firstprotocol and an encapsulation chain associated with an identified secondinterface and identified second protocol, the chain walker passing thepacket to elements of the decapsulation chain to produce a decapsulatedpacket, and the chain walker passing the decapsulated packet to elementsof an encapsulation chain to produce an encapsulated packet, each ofsaid chains comprising at least one packet-processing element, elementsin a chain being linked, an element receiving the packet from the chainwalker as processed by a previous element and further processing thepacket as appropriate, wherein the chain walker, upon receipt of thefirst protocol packet, passes said packet to elements of a demultiplexorchain associated with the first interface to produce a demultiplexedpacket, the demultiplexed packet being passed to the decapsulationchain, the demultiplexor chain, responsive to protocol informationcontained in the received packet, specifies a decapsulation chain towhich the packet should be passed.
 2. The router of claim 1 wherein thechain walker executes a chain's elements, each element returning one of:a reference to a next element in the chain to be executed, wherein thechain walker executes the referenced next element; and a null reference,wherein the chain walker stops.
 3. The router of claim 1, furthercomprising, for each interface, an associated interface descriptorblock, each interface descriptor block comprising references to at leastone of: demultiplexor chains associated with the interface;decapsulation chains associated with the interface; and encapsulationchains associated with the interface.
 4. The router of claim 1, aplurality of chains being associated with an interface, each chain beingassociated with a unique protocol.
 5. The router of claim 4, wherein anelement belongs to plural chains.
 6. The router of claim 4, wherein aunique protocol comprises a bridge-level protocol.
 7. The router ofclaim 4 wherein a unique protocol comprises a router-level protocol. 8.The router of claim 4 wherein a unique protocol comprises a tunnelingprotocol.
 9. The router of claim 1 wherein protocol information about apacket is contained in the packet.
 10. The router of claim 1 wherein thefirst interface and the second interface are different.
 11. The routerof claim 1 wherein the first interface and the second interface are thesame.
 12. The router of claim 1 wherein an interface is a virtualinterface.
 13. The router of claim 1 wherein the first protocol and thesecond protocol are different.
 14. The router of claim 1, wherein anencapsulation chain performs at least one of: encapsulation, encryption,compression, flow control and filtering.
 15. The router of claim 1,wherein the decapsulation chain performs at least one of: decapsulation,decryption, decompression and filtering.
 16. The router of claim 1, thechain walker stopping processing at any element in a chain.
 17. Therouter of claim 16, the chain walker, upon stopping processing, passingthe packet to a process external to the chain.
 18. The router of claim17, the external process being implemented by software.
 19. The routerof claim 17, the external process being implemented by hardware.
 20. Therouter of claim 17, the external process being implemented by acombination of software and hardware.
 21. The router of claim 17, thechain walker, after execution of the external process, resumingprocessing by a chain by executing an element of said chain.
 22. Therouter of claim 1, the chain walker starting execution of a chain byselecting an element of said chain and passing a packet to be processedto the selected element.
 23. The router of claim 1, wherein a packet isgenerated in a selected protocol; an interface is determined throughwhich to transmit the generated packet; the generated packet isprocessed by executing elements of an encapsulation chain associatedwith the interface and the protocol; and the processed generated packetis transmitted from the interface.
 24. A method for processing packetswithin a network router, the method comprising: receiving a firstprotocol packet in a first interface; enabling a chain walker to passsaid packet to elements of a decapsulation chain associated with thefirst interface and the first protocol to produce a decapsulated packet;enabling the chain walker to pass the decapsulated packet to elements ofan encapsulation chain associated with an identified second interfaceand identified second protocol to produce an encapsulated packet, eachchain comprising at least one packet-processing element, elements in achain being linked, an element receiving the packet from the chainwalker as processed by a previous element and further processing thepacket as appropriate, passing, upon receipt of the first protocolpacket, said packet to elements of a demultiplexor chain associated withthe first interface to produce a demultiplexed packet, the demultiplexedpacket being passed to the decapsulation chain, the demultiplexor chain,responsive to protocol information contained in the received packet,specifying a decapsulation chain to which the packet should be passed.25. The method of claim 24, each executed chain element returning oneof: a reference to a next element in the chain to be executed; and anull reference.
 26. The method of claim 24, each interface having anassociated interface descriptor block, each interface descriptor blockcomprising references to at least one of: demultiplexor chainsassociated with the interface; decapsulation chains associated with theinterface; and encapsulation chains associated with the interface. 27.The method of claim 24, a plurality of chains being associated with aninterface, each chain being associated with a unique protocol.
 28. Themethod of claim 27, wherein an element belongs to plural chains.
 29. Themethod of claim 27, wherein a unique protocol comprises a bridge-levelprotocol.
 30. The method of claim 27 wherein a unique protocol comprisesa router-level protocol.
 31. The method of claim 27 wherein a uniqueprotocol comprises a tunneling protocol.
 32. The method of claim 24wherein protocol information about a packet is contained in the packet.33. The method of claim 24 wherein the first interface and the secondinterface are different.
 34. The method of claim 24 wherein the firstinterface and the second interface are the same.
 35. The method of claim24 wherein an interface is a virtual interface.
 36. The method of claim24 wherein the first protocol and the second protocol are different. 37.The method of claim 24, an encapsulation chain performing at least oneof: encapsulation, encryption, compression, flow control and filtering.38. The method of claim 24, a decapsulation chain performing at leastone of: decapsulation, decryption, decompression and filtering.
 39. Themethod of claim 24, further comprising: stopping processing at anyelement in a chain.
 40. The method of claim 39, further comprising: uponstopping processing, passing the packet to a process external to thechain.
 41. The method of claim 40, the external process beingimplemented by software.
 42. The method of claim 40, the externalprocess being implemented by hardware.
 43. The method of claim 40, theexternal process being implemented by a combination of software andhardware.
 44. The method of claim 40, further comprising: afterexecution of the external process, resuming processing by a chain byexecuting an element of said chain.
 45. The method of claim 24, furthercomprising: starting execution of a chain by first selecting an elementof said chain and passing a packet to be processed to the selectedelement.
 46. The method of claim 24, further comprising: generating apacket in a selected protocol; determining an interface through which totransmit the generated packet; processing the generated packet byexecuting elements of an encapsulation chain associated with theinterface and the protocol; and transmitting the processed generatedpacket from the interface.